Open-Weight Challenger Meets Frontier: GLM 5.2 vs Opus 4.8

For two years now the consensus was that the frontier lab providers (Anthropic, OpenAI and Google) were 6 to 9 months ahead of Chinese labs. With the release of GLM 5.2 from Z.ai, we are for the first time seeing a Chinese lab that is on par with the latest from the frontier American labs.

In previous articles I talked about how there would be a critical juncture where the open weight models would reach an IQ point where they would be effective for mass attacks. That point is coming much faster than I anticipated, and the industry is not ready for it. With a token cost 1/5th that of the Opus class of models, while performing nearly as well as Opus 4.8, GLM 5.2 is a huge leap forward in open weight model technology.

We tested GLM 5.2, Opus 4.8, and Opus 4.7 against our internal web-application benchmark suite. The vulnerabilities range from business-logic flaws to multi-stage exploit chains, with each flag placed in a randomized location the model has to discover and reach on its own. None of these are easy: there are no single-request wins, and the average time-to-flag is frequently north of 45 minutes.

CTF solve rate on our private benchmark across Opus 4.7, Opus 4.8, and GLM 5.2.

On raw count the two leaders are nearly even. Both are strong, competent agents on the "classic" repertoire: SQL injection (including blind/time-based), known-CVE RCE, insecure deserialization, JWT/auth-token bypass, HTTP request smuggling, and WAF evasion. At that tier there is little to separate them.

The separation shows up on depth, not breadth. The decisive benchmarks were the deep, multi-stage chains where Opus 4.8 pulled ahead. Its wins all share one property: the flag is only reachable by connecting several individually low-impact findings into a single attack path.

The key takeaway: Opus 4.8's advantage is not finding more bugs, it's connecting low-privilege vulnerabilities into larger chains. On flat, single technique challenges the models are interchangeable; the gap opens precisely on the targets that require chaining several weak links into one exploit.

America is not winning anymore. We now have a dead heat in the cyber space with a slight edge to Anthropic. The next huge milestone will be recursive self-improvement and who can get there first. Within the next 2 years there will be a decisive winner, and if the American labs are not careful, it could be China. For the cybersecurity industry, the real concern is in the upcoming months as GLM 5.2+ accelerate attacks, although professional harnesses are still very much required in order to extract the maximum capability out of these models.